As AI lowers the barrier for attackers, experts say resilience must come before recovery cover
Japan has declared what its own officials call a “state of emergency in cyberspace,” and the alarm is being felt well beyond its borders. More than 20 major companies have reported breaches over the past few weeks, putting tens of millions of customers at risk of data leaks, according to the Financial Times, citing Japan’s National Cybersecurity Strategy Headquarters. The attacks have hit retail chains, restaurants, hospitals and government agencies, which suggests an attacker with wide reach rather than a single sector under pressure. mezha
A wave that kept growing
Several of the incidents are very large. Car-sharing service Times Car reported a possible breach affecting 6.6 million accounts, and rail operator JR East reported a potential leak of 1.67 million email addresses from its booking system. The JR East exposure is linked to a wider ransomware attack, as JR East’s customer email addresses were compromised in an attack hitting IDC Frontier, a SoftBank subsidiary. Other names reported in the wave include convenience store chain Lawson, Daiwa Securities and second-hand retailer BookOff. Українська правда +2
The Times Car breach has raised particular concern because user profiles stored digital photographs of driving licences, which experts estimate could fetch around 25 yen ($0.15) each on the dark web. Regulators have responded quickly. Japan’s Financial Services Agency has warned banks against accepting driving licences when opening accounts, and asked them to use documents with identification chips, such as passports or MyNumber national ID cards. mezhamezha
The year as a whole looks worse than any before it. Japan has reported more than 500 cyber incidents so far this year, according to a study by the Yomiuri newspaper and cybersecurity firm Trend Micro, and Reuters data suggests the first nine months of 2026 saw more breaches than the whole of 2025. The National Police Agency also logged a record 123 ransomware incidents in the first half of 2026. thecsrjournalthenextweb
Why Japan, and why now
Analysts point to a mix of structural weaknesses and new tools in attackers’ hands. Security experts attribute Japan’s heightened vulnerability to an ageing population, delayed digitisation of systems and legacy security practices that leave valuable data exposed. Smaller firms were once thought to be at lower risk. Smaller and mid-sized businesses could get by with outdated systems and major security gaps because they were seen as not worth the effort to target. oodaloopcpomagazine
AI is changing that calculation. Officials and analysts say AI is lowering the barriers for attackers and helping foreign actors get past the Japanese-language hurdles that previously limited targeting. The evidence is not yet conclusive, though. No direct link between artificial intelligence and the wave of attacks in Japan has yet been established, although South Korea’s president said this week that there is evidence of AI being used in cyberattacks on local banks. aiweeklymezha
Tokyo’s response
The government has told organisations to tighten their defences. It has instructed ministries, local authorities and companies to step up their cyber defences. It has also urged citizens to stop reusing passwords and to turn on multi-factor authentication wherever possible. thenextwebthecsrjournal
The timing coincides with a major legal change. Laws enabling preemptive cybersecurity measures aimed at neutralising hostile servers came into force in Japan on 1 October, and operators of key infrastructure, including power plants and railways, are now obliged to report cyber breaches to the government. The rollout is phased, however. The government’s communications-information collection capacity will not enter force until 23 November 2027, roughly 13 months after the reporting duty begins. thestarrecordedfuture
What it means for India
For Indian businesses, the Japan episode adds to a threat that is already large. CERT-In reported more than 2.04 million cybersecurity incidents in India in 2024. Regulation has also raised the stakes. The DPDP Act 2023 and CERT-In’s 6-hour incident reporting rule have made a cyber breach a regulatory event, not just an IT problem. eydealplexus
Industry experts say Japan should prompt Indian companies to look at how well they are prepared, not just how well they are covered. Evaa Saiwal, Head of Cyber & Liability Insurance at Policybazaar for Business, said:
“The reported cyber incident in Japan, which has affected 14 million citizens and nearly 500 businesses, in a matter of hours highlights how rapidly cyber threats are evolving and the scale of disruption they can cause. With AI making attacks more sophisticated, targeted and easier to scale, the impact can extend beyond data breaches to operational downtime, financial losses and reputational damage. For Indian businesses, this is a reminder that cybersecurity and business continuity planning must go hand in hand. Cyber insurance can support incident response, recovery and business interruption losses, subject to policy terms and exclusions. However, it cannot replace strong security controls. Businesses must invest in cyber resilience while ensuring their insurance coverage reflects their evolving risk exposure.”
Cover is only as good as the fit
Her point about matching coverage to risk is borne out by what Indian buyers report. In a Deloitte India survey, approximately 45 percent of respondents noted a substantial mismatch between the premium paid and the coverage received. Policies also have limits. Cyberattacks related to war, terrorism or government-backed attacks are usually not covered under a cyber liability insurance policy. deloitteupstox
The insurance market itself is moving towards stricter standards. As ransomware, supply chain attacks and AI-driven attacks become more damaging and expensive, insurers are pushing for stronger cybersecurity controls, AI-driven assessments and tailored policy designs. The same EY analysis notes that businesses may benefit from improving their cyber hygiene scores, much like maintaining a strong credit rating. eyey
The takeaway
Japan’s experience shows how fast a run of attacks can spread across industries, and how long it can take for a country’s legal and technical defences to catch up. For Indian companies, the practical steps are to strengthen security controls, test incident response and continuity plans, and review whether insurance coverage reflects current exposure, including its exclusions. Insurance can help a business recover after a breach, but it cannot replace the controls that make a breach less likely.
